I just found this video of mine, where I set $D60C (which is the viridian pokemart / oak's parcel status flag) to 0x68. I don't think this can be done without cheating or ACE, but it's a kinda scary effect.

So I just hacked in bgb to prove that I know what I'm going for. I'll use a tad of arbitrary code execution to set the amount of PC Items to 51 (or anything over 50), then buy/collect 93 casino chips.

I also just had a look at the money, and even though it was "99 99 99" in the code, I don't think it's the same way on the actual cartridge... I'll use ACE to set it to 63 (equivalent to 99 in decimal) and see if the result is 63 or 99. If it's 63 there's a discrepancy in the emulator in a perhaps major way. If it's 99... then there's still the capping mystery to be solved :/

When you fly away from a long-range trainer, the game is waiting for the NPC to finish their walking animation before it shows the encounter text and starts the battle. A Strength boulder’s animation must work the same way as an NPC’s, so it clears the flag that allows the battle to start.

By that logic, the reason that the entirety of the elite four must be beaten is because... professor oak walks at the end. Are there any other locations where this might be doable? (EG... a trainer that walks?)

You can also use the guy who stops you from leaving Pewter City if you haven’t beaten Brock yet, or the guy who escorts you to Pewter Museum (using the box save trick to be able to talk to him). The only other walking NPCs in the game that I know of are one-time story events.

(I was thinking for a moment that the guard blocking off the S.S. Anne might be usable, but he’s not, because he only makes you move, without moving himself.)

Aren't there a few walking trainers in cinnabar mansion? (Though they stop walking after you've beaten them -- that's how Twitch Plays Pokémon got trapped). Would those work?

When you fly away from a long-range trainer, the game is waiting for the NPC to finish their walking animation before it shows the encounter text and starts the battle. A Strength boulder’s animation must work the same way as an NPC’s, so it clears the flag that allows the battle to start.

By that logic, the reason that the entirety of the elite four must be beaten is because... professor oak walks at the end. Are there any other locations where this might be doable? (EG... a trainer that walks?)

I would very much like suggestions on roms, emulators, and recording programs. I've been working completely with cartridge and my old GBC, they are nice, but I am feeling certain limitations with them, mostly in speed. So if you like, please feel free to suggest an emulator or rom that is most similar to the original cartridge, I did just download the emulator Visual Boy Advance 1.8.0 Beta3 and the rom Pokemon yellow U [C][BF].

Can't give you too much advice on roms .

For emulators, don't use the original VBA (it's extremely old). I recommend using bgb, but there's also VBA-M and VBA-RR, which are updated versions of VBA.

For screen recording, I recommend OBS, which can be configured to save to files (it defaults to livestreaming).

Videos generally work well enough for evidence, and also generally provides a good way to make things reproducible.

I actually haven't been too active on these forums for a while, so I can't answer many of your other questions. But the glitches you describe sound interesting.

Good question. I will look into it. Changing the music would be a cool thing to do. What code did you use, is it 010576CF? I can't check what that does at the moment, sadly but I might be able to later.

That is certainly the correct code (though I would advise using 910576CF instead, as it seems crystal needs that). It's also the code causing the crashing - that code alone causes the crash without a music code.

I had an alternate idea: Rather than gameshark, patch the rom with a GameGenie code. Since it seems like it is unavoidable to skip the pause menu using that address, I can instead modify where it gets the menu info from.

According to the crystal disassembly, the function that does this is located at 1ea6. (I still don't know gbz80, but I could find that with a search for the address CF76). Opening up that address with VBA and I see 1EC3 represents the specific instruction I want - LD A,(CF76h) (represented by hex FA76CF). Changing this to LD A,(004Ah) gives me the required effect - that location is, at least in my rom, a constant value of 0x05. This would be done with the following gamegenie codes, which change bytes $1EC4 from 76 to 4A and $1EC5 from CF to 00:

Code 1 changes $1EC3 from FA to 3E. Code 2 changes $1EC4 from 7C to 05 (if you wish to supply a different value, you'd modify this code). Code 3 changes $1EC5 from CF to 00.

Note that these codes don't have the third set of digits used to validate banks. This is unneeded since it's in the nonchanging part of the rom, but it might be incompatible with old versions of the gamegenie.